Stored Cross-Site Scripting in CleanTalk Plugin for WordPress

CVE-2026-77830

What is CVE-2026-77830?

The CleanTalk Anti-Spam plugin for WordPress is susceptible to Stored Cross-Site Scripting, enabling attackers with authenticated access to insert arbitrary scripts through comment content. This flaw arises from inadequate input sanitization and output escaping practices, allowing scripts to execute in the context of non-logged-in users when they visit a compromised page. The vulnerability is particularly concerning as it can be exploited through unauthenticated comment submissions, provided that the comments are approved by an administrator, potentially exposing a broader audience to malicious attacks.

References